Unrestricted File Upload Vulnerability in AvePoint Products
CVE-2025-10544

8.6HIGH

Key Information:

Vendor

Avepoint

Status
Docave
Perimeter
Compliance Guardian
Vendor
CVE Published:
26 September 2025

What is CVE-2025-10544?

The vulnerability exists within AvePoint products, allowing unauthorized file uploads by administrator users. This security flaw enables attackers to upload malicious files that can compromise the entire system. Furthermore, due to a Path Traversal issue, attackers can manipulate file paths, granting them the ability to write files to arbitrary directories within the web root, creating significant risks for data integrity and security.

Affected Version(s)

Compliance Guardian 0 < 4.7.1

DocAve 6.13.2

Perimeter 1.12.3

References

https://www.incibe.es/en/incibe-cert/notices/aviso/unrest...

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Chetani Mesa Guzmán
JSON
.
CVE-2025-10544 : Unrestricted File Upload Vulnerability in AvePoint Products